Unauthorized api after 15 minutes after upgrading openziti/quickstart to 2.0.0

After updating openziti/quickstart docker image to 2.0.0. my keep-alive requests dont work anymore.

when i start my api, i can create admins(on create it creates openziti identity for that admin). after 10-15 minutes i cant create new admins anymore. i get this error:
api-server-1 | 2026/09/03 13:10:31 identity.go:126: {"error":{"code":"UNAUTHORIZED","message":"The request could not be completed. The session is not authorized or the credentials are invalid","requestId":"3U6cz5iBO"},"meta":{"apiEnrollmentVersion":"0.0.1","apiVersion":"0.0.1"}}

my code has keepalive requests every 10 minutes

my code:

func SetupOpenziti(ctrlUrl string, zitiIDPath string) error {

    err := EnrollIfNeeded(zitiIDPath)

if err != nil {

log.Print(err)

return err

    }

err = CreateApiSession(ctrlUrl, zitiIDPath)

if err != nil {

log.Print(err)

return err

    }

err = InitCon(zitiIDPath)

if err != nil {

log.Print(err)

return err

    }




go KeepAlive(ctrlUrl)

return nil

}

func CreateApiSession(ctrlUrl string, zitiIDPath string) error {

    // Read the JSON file

jsonFile, err := os.ReadFile(zitiIDPath + ".json")

if err != nil {

log.Print(err)

return err

    }




var jsonData map[string]interface{}

err = json.Unmarshal(jsonFile, &jsonData)

if err != nil {

log.Print(err)

return err

    }




// Create a new map[interface{}]interface{}

convertedMap := make(map[interface{}]interface{})




// Copy each key-value pair from the original map to the new map

for key, value := range jsonData["id"].(map[string]interface{}) {

convertedMap[key] = value

    }




// Get api session from openziti

urls := make([]*url.URL, 1)

apiUrl, _ := url.Parse(ctrlUrl + "/edge/management/v1")

urls[0] = apiUrl




// Create Identitiy credentials from .json identity

conf, err := identity.NewConfigFromMap(convertedMap)

if err != nil {

log.Print(err)

return err

    }

credentials := edge_apis.NewIdentityCredentialsFromConfig(*conf)




// Authenticate and get token

var configTypes []string

managementClient := edge_apis.NewManagementApiClient(urls, credentials.GetCaPool(), func(ch chan string) {})

apiSesionDetial, err := managementClient.Authenticate(credentials, configTypes)

if err != nil {

log.Print(err)

return err

    }

_, token := apiSesionDetial.GetAccessHeader()

SessionToken = token




if os.Getenv("DEV_ENV") == "true" {

log.Printf("Ziti session token: %s", SessionToken)

    } else {

log.Print("Created ziti api session")

    }

return nil

}




// Pings openziti controller every X seconds to keep the api session alive

func KeepAlive(ctrlUrl string) {

ticker := time.NewTicker(time.Minute * 10)




for range ticker.C {

// Make the HTTPS GET request

url := ctrlUrl + "/edge/management/v1/"

req, err := http.NewRequest("GET", url, nil)

if err != nil {

log.Print(err)

return

        }

req.Header.Set("Content-Type", "application/json")

req.Header.Add("zt-session", SessionToken)




// Perform the request

client := &http.Client{}

resp, err := client.Do(req)

if err != nil {

log.Print(err)

return

        }

defer resp.Body.Close()




// Read the response body

body, err := io.ReadAll(resp.Body)

if err != nil {

log.Print(err)

return

        }




// Print the response body

log.Printf("Performed keep alive for openziti session response: %s", body)

    }

}

are there any breaking changes in this? My previous version of openziti/quickstart was 1.6.6 i upgraded to 2.0.0. What do i need to do, so my api can call openziti api even after 10-20 or more minutes.

Any help would be greatly appreciated!

This looks like a bug.

What i tried:
updated ziti-controller.yaml with:
api:
#(optional, default 90s) Alters how frequently heartbeat and last activity values are persisted
# activityUpdateInterval: 90s
#(optional, default 250) The number of API Sessions updated for last activity per transaction
# activityUpdateBatchSize: 250
# sessionTimeout - optional, default 30m
# The number of minutes before an Edge API session will time out. Timeouts are reset by
# API requests and connections that are maintained to Edge Routers
sessionTimeout: 2m

updated my keep alive code to ping every 1 minute:

func KeepAlive(ctrlUrl string) {

    ticker := time.NewTicker(time.Minute * 1)

restarted by docker containers. i tried creating new identities, it worked for 2 minutes, then after 2 minutes passed i get unauthorized response.

documentation clearly states:

    # sessionTimeout - optional, default 30m

    # The number of minutes before an Edge API session will time out. Timeouts are reset by

# API requests and connections that are maintained to Edge Routers

So the keep alives should work, as it did before.

my sdk versions:

github.com/openziti/channel/v4 v4.2.21 // indirect

    github.com/openziti/edge-api v0.26.47 // indirect

github.com/openziti/foundation/v2 v2.0.70 // indirect

github.com/openziti/identity v1.0.109 // indirect

github.com/openziti/metrics v1.4.2 // indirect

github.com/openziti/sdk-golang v1.2.2 // indirect

github.com/openziti/secretstream v0.1.38 // indirect

github.com/openziti/transport/v2 v2.0.183 // indirect

github.com/openziti/ziti v1.6.7 // indirect

updating openziti sdk versions did not fix the issue:

    github.com/openziti/channel/v5 v5.0.29 // indirect 
   github.com/openziti/edge-api v0.36.0 // indirect    
github.com/openziti/foundation/v2 v2.0.100 // indirect   
 github.com/openziti/identity v1.0.140 // indirect    
github.com/openziti/metrics v1.4.5 // indirect    
github.com/openziti/sdk-golang v1.9.0 // indirect    
github.com/openziti/secretstream v0.1.52 // indirect   
 github.com/openziti/transport/v2 v2.0.221 // indirect